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Begin 



initiate a RADIUS 
session between 
the user and the 
network device 



authorize or 
reject the 
command based 
on the results of 
the determining 



/I0 



purge the user 
profile from 
the cache 



receive a user profile for 
the user from an AAA 
server, the user profile 
containing information 
regarding which 
commands the user is 
authorized to execute 
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determine whether the 
command is 
authorized based on 
the information in the 
user profile for the 
user stored in the 
cache 



-J— 



End 



store the user 
profile in a 
cache 



/oy 



receive the 
command 
from the user 
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operl Password = "abc A 123" 
Service-Type = Login 
2,t> H ~* Cisco: AVPair = "shell:cmd-expr=show .*", 
ZOk> —Cisco: AVPair = "shell:cmd-expr=telnet 10\. 14\.0\.[0-9]+", 
"2S>% ~~ Cisco: AVPair = " shell :cmd-expr=ping .*" 
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